fix(scope): close final ownership races

Drain idle injection flushes before agent teardown, snapshot approval and subagent provider inputs, and gate subagent lifecycle events on real child readiness. Align the RFCs and generated contracts with the hardened behavior.

packages/core/agent/src/index.ts

@@ -107,11 +107,12 @@ export interface ResumeAgentOptions {
 /**
  * An owned agent plus its disposer, returned by {@link AgentRegistry.create} /
  * {@link AgentRegistry.resume}. The disposer is a CAPABILITY: only the holder
- * can tear this agent down. `dispose()` stops the loop, awaits its exit
- * (quiescence — NOT just the `disposed` status flip), unregisters the agent,
- * removes its session from the store, and finally unwinds its scoped world.
- * This order captures the loop's final `session/flush` before the session is
- * detached and keeps scoped listeners alive through that flush.
+ * can tear this agent down. `dispose()` stops the loop, awaits its exit and
+ * every outstanding idle-injection flush (quiescence — NOT just the `disposed`
+ * status flip), unregisters the agent, removes its session from the store, and
+ * finally unwinds its scoped world. This order captures every agent-started
+ * `session/flush` before the session is detached and keeps scoped listeners
+ * alive through those checkpoints.
  *
  * `ctx.agents.get(id)` still returns a bare {@link Agent} — the handle is only
  * for the OWNER that created it. Config-created agents (the loop's own startup)

packages/core/agent/src/types.ts

@@ -222,8 +222,10 @@ export interface Agent {
    * turn (`turn/start` → `context/message` → `turn/end`) and checkpoints it for
    * durability, so every event stays inside a turn and a persistence backend
    * never loses a between-turn notice. The idle checkpoint is fire-and-forget
-   * (inject is synchronous): a failing flush is reported via `agent/error`
-   * (step `0`) and the logger, never thrown into the caller.
+   * from this synchronous method, but lifecycle disposal awaits it before
+   * unregistering the agent or detaching its session. A failing flush is
+   * reported via `agent/error` (step `0`) and the logger, never thrown into the
+   * caller.
    *
    * Live-adapter review has validated the tagged-envelope rendering against
    * current DeepSeek behavior; provider-specific mismatches belong in that